<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Linux 容器化核心技术：cgroups 与 namespaces</title>
    <link rel="stylesheet" href="https://cdn.staticfile.org/font-awesome/6.4.0/css/all.min.css">
    <link rel="stylesheet" href="https://cdn.staticfile.org/tailwindcss/2.2.19/tailwind.min.css">
    <link href="https://fonts.googleapis.com/css2?family=Noto+Serif+SC:wght@400;500;600;700&family=Noto+Sans+SC:wght@300;400;500;700&display=swap" rel="stylesheet">
    <script src="https://cdn.jsdelivr.net/npm/mermaid@latest/dist/mermaid.min.js"></script>
    <style>
        body {
            font-family: 'Noto Sans SC', Tahoma, Arial, Roboto, "Droid Sans", "Helvetica Neue", "Droid Sans Fallback", "Heiti SC", "Hiragino Sans GB", Simsun, sans-serif;
            background: linear-gradient(135deg, #f5f7fa 0%, #c3cfe2 100%);
            min-height: 100vh;
        }
        .hero-gradient {
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
        }
        .card-hover {
            transition: all 0.3s ease;
        }
        .card-hover:hover {
            transform: translateY(-5px);
            box-shadow: 0 20px 40px rgba(0,0,0,0.1);
        }
        .code-block {
            background: #1e293b;
            color: #e2e8f0;
            border-radius: 8px;
            padding: 1rem;
            overflow-x: auto;
            font-family: 'Consolas', 'Monaco', monospace;
        }
        .first-letter {
            float: left;
            font-size: 4rem;
            line-height: 3rem;
            padding-right: 0.5rem;
            font-weight: 700;
            color: #667eea;
        }
        .section-divider {
            background: linear-gradient(to right, transparent, #667eea, transparent);
            height: 2px;
            margin: 3rem 0;
        }
        .feature-icon {
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            -webkit-background-clip: text;
            -webkit-text-fill-color: transparent;
        }
        .mermaid {
            display: flex;
            justify-content: center;
            margin: 2rem 0;
        }
    </style>
</head>
<body>
    <!-- Hero Section -->
    <section class="hero-gradient text-white py-20">
        <div class="container mx-auto px-6 text-center">
            <h1 class="text-5xl md:text-6xl font-bold mb-6 tracking-tight">
                Linux 容器化核心技术
            </h1>
            <h2 class="text-2xl md:text-3xl font-light mb-8 opacity-90">
                深入理解 cgroups 与 namespaces
            </h2>
            <p class="text-lg md:text-xl max-w-3xl mx-auto leading-relaxed opacity-80">
                探索容器技术的基石，了解如何通过资源控制和环境隔离实现高效的容器化部署
            </p>
            <div class="mt-10 flex justify-center space-x-6">
                <div class="text-center">
                    <i class="fas fa-layer-group text-4xl mb-2"></i>
                    <p class="text-sm">资源隔离</p>
                </div>
                <div class="text-center">
                    <i class="fas fa-shield-alt text-4xl mb-2"></i>
                    <p class="text-sm">安全保障</p>
                </div>
                <div class="text-center">
                    <i class="fas fa-tachometer-alt text-4xl mb-2"></i>
                    <p class="text-sm">性能优化</p>
                </div>
            </div>
        </div>
    </section>

    <!-- Main Content -->
    <main class="container mx-auto px-6 py-12 max-w-6xl">
        <!-- Introduction -->
        <section class="bg-white rounded-2xl shadow-xl p-8 md:p-12 mb-12">
            <p class="text-lg leading-relaxed text-gray-700">
                <span class="first-letter">在</span>Linux 系统中，<code class="bg-purple-100 text-purple-800 px-2 py-1 rounded">cgroups</code>（控制组）和 <code class="bg-purple-100 text-purple-800 px-2 py-1 rounded">namespaces</code> 是容器化应用资源隔离的核心技术。它们提供了资源管理和环境隔离的基础，使得多个容器可以在同一台物理主机上并行运行而不会互相干扰。
            </p>
        </section>

        <!-- Architecture Visualization -->
        <section class="bg-white rounded-2xl shadow-xl p-8 md:p-12 mb-12">
            <h3 class="text-2xl font-bold mb-6 text-gray-800">
                <i class="fas fa-sitemap feature-icon mr-3"></i>容器化技术架构
            </h3>
            <div class="mermaid">
                graph TB
                    A[Linux 内核] --> B[cgroups]
                    A --> C[namespaces]
                    B --> D[CPU 限制]
                    B --> E[内存限制]
                    B --> F[I/O 控制]
                    B --> G[网络带宽]
                    C --> H[PID 隔离]
                    C --> I[网络隔离]
                    C --> J[文件系统隔离]
                    C --> K[用户隔离]
                    D --> L[容器1]
                    E --> L
                    H --> L
                    I --> L
                    D --> M[容器2]
                    E --> M
                    H --> M
                    I --> M
                    style A fill:#667eea,stroke:#fff,stroke-width:2px,color:#fff
                    style B fill:#764ba2,stroke:#fff,stroke-width:2px,color:#fff
                    style C fill:#764ba2,stroke:#fff,stroke-width:2px,color:#fff
                    style L fill:#f59e0b,stroke:#fff,stroke-width:2px,color:#fff
                    style M fill:#f59e0b,stroke:#fff,stroke-width:2px,color:#fff
            </div>
        </section>

        <!-- cgroups Section -->
        <section class="mb-12">
            <div class="bg-gradient-to-r from-purple-600 to-purple-800 text-white rounded-t-2xl p-6">
                <h2 class="text-3xl font-bold flex items-center">
                    <i class="fas fa-layer-group mr-4"></i>
                    1. cgroups（Control Groups）
                </h2>
            </div>
            <div class="bg-white rounded-b-2xl shadow-xl p-8 md:p-12">
                <p class="text-lg leading-relaxed text-gray-700 mb-8">
                    <code class="bg-purple-100 text-purple-800 px-2 py-1 rounded">cgroups</code> 是 Linux 内核提供的一种机制，用于限制、记录和隔离进程组的资源使用情况。它允许系统管理员对系统资源进行精细控制。
                </p>

                <!-- Features Grid -->
                <div class="grid md:grid-cols-3 gap-6 mb-10">
                    <div class="card-hover bg-gradient-to-br from-purple-50 to-pink-50 p-6 rounded-xl">
                        <div class="text-3xl mb-4 feature-icon">
                            <i class="fas fa-ban"></i>
                        </div>
                        <h4 class="text-xl font-bold mb-2 text-gray-800">资源限制</h4>
                        <p class="text-gray-600">限制进程组的 CPU、内存、磁盘 I/O 和网络带宽等资源使用。</p>
                    </div>
                    <div class="card-hover bg-gradient-to-br from-blue-50 to-indigo-50 p-6 rounded-xl">
                        <div class="text-3xl mb-4 feature-icon">
                            <i class="fas fa-sort-amount-up"></i>
                        </div>
                        <h4 class="text-xl font-bold mb-2 text-gray-800">资源优先级</h4>
                        <p class="text-gray-600">设置资源优先级，确保高优先级进程组获得更多资源。</p>
                    </div>
                    <div class="card-hover bg-gradient-to-br from-green-50 to-teal-50 p-6 rounded-xl">
                        <div class="text-3xl mb-4 feature-icon">
                            <i class="fas fa-chart-line"></i>
                        </div>
                        <h4 class="text-xl font-bold mb-2 text-gray-800">监控</h4>
                        <p class="text-gray-600">记录和监控资源使用情况，便于分析和优化。</p>
                    </div>
                </div>

                <!-- Subsystems -->
                <h4 class="text-2xl font-bold mb-6 text-gray-800">
                    <i class="fas fa-cogs text-purple-600 mr-3"></i>常用的子系统
                </h4>
                <div class="grid md:grid-cols-2 gap-4 mb-10">
                    <div class="flex items-center p-4 bg-gray-50 rounded-lg">
                        <i class="fas fa-microchip text-2xl text-purple-600 mr-4"></i>
                        <div>
                            <code class="font-bold text-purple-800">cpu</code>
                            <span class="text-gray-600 ml-2">限制 CPU 使用率</span>
                        </div>
                    </div>
                    <div class="flex items-center p-4 bg-gray-50 rounded-lg">
                        <i class="fas fa-memory text-2xl text-purple-600 mr-4"></i>
                        <div>
                            <code class="font-bold text-purple-800">memory</code>
                            <span class="text-gray-600 ml-2">限制内存使用量</span>
                        </div>
                    </div>
                    <div class="flex items-center p-4 bg-gray-50 rounded-lg">
                        <i class="fas fa-hdd text-2xl text-purple-600 mr-4"></i>
                        <div>
                            <code class="font-bold text-purple-800">blkio</code>
                            <span class="text-gray-600 ml-2">控制块设备的 I/O</span>
                        </div>
                    </div>
                    <div class="flex items-center p-4 bg-gray-50 rounded-lg">
                        <i class="fas fa-network-wired text-2xl text-purple-600 mr-4"></i>
                        <div>
                            <code class="font-bold text-purple-800">net_cls</code>
                            <span class="text-gray-600 ml-2">为网络流量分配分类</span>
                        </div>
                    </div>
                </div>

                <!-- Code Examples -->
                <h4 class="text-2xl font-bold mb-6 text-gray-800">
                    <i class="fas fa-code text-purple-600 mr-3"></i>使用示例
                </h4>
                <div class="space-y-6">
                    <div>
                        <p class="text-gray-700 mb-2 font-semibold">创建 cgroup：</p>
                        <div class="code-block">
                            <code>mkdir /sys/fs/cgroup/cpu/my_cgroup</code>
                        </div>
                    </div>
                    <div>
                        <p class="text-gray-700 mb-2 font-semibold">限制 CPU 使用：</p>
                        <div class="code-block">
                            <code>echo 50000 > /sys/fs/cgroup/cpu/my_cgroup/cpu.cfs_quota_us</code>
                        </div>
                    </div>
                    <div>
                        <p class="text-gray-700 mb-2 font-semibold">将进程添加到 cgroup：</p>
                        <div class="code-block">
                            <code>echo &lt;pid&gt; >> /sys/fs/cgroup/cpu/my_cgroup/cgroup.procs</code>
                        </div>
                    </div>
                </div>
            </div>
        </section>

        <div class="section-divider"></div>

        <!-- namespaces Section -->
        <section class="mb-12">
            <div class="bg-gradient-to-r from-indigo-600 to-blue-800 text-white rounded-t-2xl p-6">
                <h2 class="text-3xl font-bold flex items-center">
                    <i class="fas fa-shield-alt mr-4"></i>
                    2. namespaces
                </h2>
            </div>
            <div class="bg-white rounded-b-2xl shadow-xl p-8 md:p-12">
                <p class="text-lg leading-relaxed text-gray-700 mb-8">
                    <code class="bg-blue-100 text-blue-800 px-2 py-1 rounded">namespaces</code> 提供了进程和系统资源的隔离。每个 namespace 都可以拥有自己独立的系统视图，包括进程、网络、文件系统等。
                </p>

                <!-- Namespace Types -->
                <h4 class="text-2xl font-bold mb-6 text-gray-800">
                    <i class="fas fa-cubes text-blue-600 mr-3"></i>主要类型
                </h4>
                <div class="grid md:grid-cols-2 gap-6 mb-10">
                    <div class="card-hover border-l-4 border-blue-500 bg-blue-50 p-6 rounded-r-xl">
                        <h5 class="font-bold text-lg mb-2 text-blue-800">
                            <i class="fas fa-fingerprint mr-2"></i>PID namespace
                        </h5>
                        <p class="text-gray-700">隔离进程